test(skills): split installer security coverage

src/infra/install-safe-path.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { safePathSegmentHashed } from "./install-safe-path.js";
+
+describe("safePathSegmentHashed", () => {
+  it("keeps safe names unchanged", () => {
+    expect(safePathSegmentHashed("demo-skill")).toBe("demo-skill");
+  });
+
+  it("normalizes separators and adds hash suffix", () => {
+    const result = safePathSegmentHashed("../../demo/skill");
+    expect(result.includes("/")).toBe(false);
+    expect(result.includes("\\")).toBe(false);
+    expect(result).toMatch(/-[a-f0-9]{10}$/);
+  });
+
+  it("hashes long names while staying bounded", () => {
+    const long = "a".repeat(100);
+    const result = safePathSegmentHashed(long);
+    expect(result.length).toBeLessThanOrEqual(61);
+    expect(result).toMatch(/-[a-f0-9]{10}$/);
+  });
+});

src/infra/path-safety.test.ts

@@ -0,0 +1,16 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { isWithinDir, resolveSafeBaseDir } from "./path-safety.js";
+
+describe("path-safety", () => {
+  it("resolves safe base dir with trailing separator", () => {
+    const base = resolveSafeBaseDir("/tmp/demo");
+    expect(base.endsWith(path.sep)).toBe(true);
+  });
+
+  it("checks directory containment", () => {
+    expect(isWithinDir("/tmp/demo", "/tmp/demo")).toBe(true);
+    expect(isWithinDir("/tmp/demo", "/tmp/demo/sub/file.txt")).toBe(true);
+    expect(isWithinDir("/tmp/demo", "/tmp/demo/../escape.txt")).toBe(false);
+  });
+});